We collect the bare minimum: what is needed to ship your order, invoice it and reply to you. This page explains what data we process, for what purposes, for how long, who has access to it and how to regain control over it.
This document is drafted in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Last updated: September 2026.
1. Who is the data controller
- Controller: [[COMPANY NAME]], owner of the website pkmndistrict.com
- Tax ID (NIF): [[NIF]]
- Address: [[ADDRESS]]
- Contact for any question about personal data: pkmndistrict.team@proton.me
We are not required to appoint a data protection officer under Article 37 GDPR and Article 34 of the LOPDGDD. Should we appoint one, we will publish their contact details here.
2. What data we collect
We only process data that you provide to us or that is generated by your use of the site.
- Identity and contact: first name, surname, email, phone.
- Addresses: delivery address and billing address.
- Orders: items, amount, date, order number, purchase history, shipping status and tracking number.
- Payment: payment method type, transaction status and last four digits of the card. We never see or store your full card number or security code: this data is processed directly by our payment provider in a PCI DSS-certified environment.
- Customer account, if you create one: login credentials and preferences.
- Customer service: content of your emails, messages and attachments, history of exchanges.
- Reviews and photos that you choose to publish.
- Newsletter: email address, date of consent, opens and clicks.
- Browsing: IP address, device and browser type, pages viewed, products viewed, cart contents and cookie identifiers. See our Cookie policy.
- Fraud prevention: technical signals used by our providers to detect fraudulent orders.
Required fields are marked on the forms. Without them, we cannot process your order.
3. Why we process it and on what legal basis
- Processing and tracking your order, managing delivery and returns: performance of the contract (article 6.1.b of the GDPR).
- Managing your customer account: performance of the contract.
- Payment collection: performance of the contract.
- Issuing and keeping invoices and keeping the accounts: legal obligation (Article 6.1.c GDPR, Article 30 of the Spanish Commercial Code and tax legislation).
- Responding to your enquiries and complaints: performance of the contract and legitimate interest.
- Applying the legal guarantee and the right of withdrawal: legal obligation.
- Preventing fraud: legitimate interest (Article 6(1)(f) GDPR), namely protecting our business.
- Sending the newsletter and commercial offers: your consent (Article 6.1.a of the GDPR), or legitimate interest for similar products if you are already a customer, in accordance with Article 21.2 of Law 34/2002, with the option to unsubscribe at any time.
- Publishing customer reviews: your consent.
- Measuring site traffic and improving pages: your consent, except for exempt first-party analytics under Article 22.2 of Law 34/2002 and the AEPD cookie guide.
- Advertising and remarketing: your consent.
- Ensuring site security and keeping technical logs: legitimate interest.
The analytics and advertising tools actually active on the site are listed in the cookie panel, where you can also disable them one by one.
4. Who has access to your data
We do not sell or rent your data. It is accessed by our authorised staff and the following providers, who act as processors or, as the case may be, as controllers:
- Shopify International Limited (Bunkers Hill, Dublin 2, Ireland), which hosts the store and the order database.
- Payment providers, to process transactions and prevent fraud.
- Carriers, which receive your name, address, email and phone number, strictly to deliver and track the parcel.
- Email sending provider, for order confirmations, tracking and the newsletter.
- Customer review solution, where applicable.
- Audience measurement and advertising tools, only if you have given your consent.
- Accounting and tax advisor, to comply with our obligations.
- Administrative or judicial authorities, when required by law.
Each processor is bound by a contract in accordance with Article 28 of the GDPR that prohibits it from using your data for its own purposes.
5. How long we keep them
- Order and delivery data: 5 years from delivery, the limitation period for personal actions under Article 1964.2 of the Spanish Civil Code.
- Invoices and accounting records: 6 years from the last entry, in accordance with article 30 of the Commercial Code, and 4 years for tax purposes.
- Customer account: while the account is active, then 3 years from your last contact.
- Newsletter contacts who are not customers: until you unsubscribe and, in any case, 3 years from the last contact, after which it is deleted or anonymised.
- Exchanges with customer service: 3 years from the last message.
- Payment data (never the card number, which we do not keep): for the duration of the transaction, then the intermediate retention applicable to the provider under its legal obligations.
- Published reviews: for as long as the review is online, until you request its removal.
- Cookies and associated browsing data: 24 months at most.
- Proof of cookie consent: 24 months.
- Connection and security logs: 12 months.
Once these periods have elapsed, the data is deleted or anonymised, except where it is blocked and kept available to judges, courts and public authorities during the limitation period, in accordance with Article 32 of the LOPDGDD.
6. Transfers outside the European Union
Our hosting provider, Shopify, is established in Ireland, i.e. within the European Union. However, some of its infrastructure and some of our providers may process data from countries outside the European Economic Area, in particular the United States and Canada.
These transfers rely on at least one of the mechanisms provided for in Chapter V of the GDPR:
- an adequacy decision of the European Commission, for example Canada or the EU-US Data Privacy Framework for certified US companies;
- the standard contractual clauses adopted by the European Commission;
- additional technical and organisational measures, in particular encryption.
You can obtain a copy of the applicable safeguards by writing to pkmndistrict.team@proton.me.
7. Your rights
You have the following rights over your data at all times:
- Log in (Article 15 GDPR): to know whether we process your data and to obtain a copy.
- Rectification (Article 16): correct inaccurate or incomplete data.
- Erasure (Article 17): ask us to erase your data, except where the law requires us to keep it, as is the case for invoices.
- Restriction of processing (Article 18): ask us to freeze your data while something is being verified.
- Objection (article 21): object to processing based on our legitimate interest, without having to give reasons where direct marketing is concerned.
- Portability (Article 20): receive the data you have provided to us in a structured, machine-readable format, or have us transmit it to another controller.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Rights of deceased persons (Article 3 of the LOPDGDD): your heirs may request access to, rectification or erasure of your data, unless you have expressly prohibited it.
How to exercise them
Write to pkmndistrict.team@proton.me o a [[ADDRESS]], stating your request. We may ask you for proof of identity if there is reasonable doubt. We respond within one month, which may be extended to three months if the request is complex, in which case we will let you know.
To unsubscribe from the newsletter, simply use the link at the bottom of every email.
8. Complaint to the Spanish Data Protection Agency (AEPD)
If you believe we are not respecting your rights, you can lodge a complaint with the supervisory authority:
- Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid
- Electronic office: sedeagpd.gob.es
- Information: www.aepd.es
We do ask that you write to us first, though: almost every request is resolved in a single email.
9. Cookies
The site uses cookies and similar technologies. Those that are not strictly necessary for the site to function are only set after your consent, collected via the notice shown on your first visit. Details are available in our Cookie policy, where you can also change your preferences at any time.
10. Security
We apply appropriate technical and organisational measures: encryption of communications via HTTPS, data access limited to authorised staff, strong authentication on administration tools, hosting with a certified provider and payments processed in a PCI DSS environment.
In the event of a security breach likely to result in a high risk to your rights, we will notify you without undue delay, in accordance with Article 34 GDPR.
11. Minors
The site is intended for adults. Under article 7 of the LOPDGDD, processing a minor's data on the basis of their consent is only lawful from the age of fourteen, and below that age requires the consent of the holder of parental authority or guardianship. We do not knowingly collect data from children under fourteen. If such collection were reported to us, the data would be deleted immediately.
12. Automated decisions
We do not make decisions that produce legal effects concerning you based solely on automated processing, except for the anti-fraud checks carried out by our payment providers, which may lead to a transaction being declined. In that case, you can request a human review by writing to us.
13. Changes to this policy
This policy may change, for example if we add a tool or if regulations change. The applicable version is the one published on this page. If the change is substantial, we will inform you by email or by a notice on the site.